Protection providers urged to rethink medical data requests

Protection providers must rethink their strategy for obtaining applicants’ medical details after the Information Commissioner’s Office accused them of “abusing” subject access requests.

The ICO clashed with Legal & General last week over its use of subject access requests, claiming the insurer was guilty of publishing false information.

Some insurers, including L&G and Aviva, have until now used subject access requests rather than GP reports to obtain medical information on protection applicants.

They argue this gives them more comprehensive information which aids the underwriting process.

GP practices must also respond to a subject access request within 40 days (and 21 days under NHS policy). There are no time limits for GP reports.

But after the British Medical Association raised concerns about the practice in July, the ICO branded it “inappropriate” in a strongly-worded statement.

The ICO said: “By making a subject access request on a patient’s behalf, an insurance company may be provided with a patient’s entire medical record, including information that is not relevant for the purpose of underwriting a policy.

“The ICO has recently written to the insurance industry to explain we consider the use of subject access rights in this way is inappropriate and an abuse of that right.

“We also have concerns that the processing of medical records by insurers once received from GPs is likely to breach the Data Protection Act.”

Following this statement, Aviva has stopped using subject access requests.

But in a recent email to advisers, L&G said it will continue to do so following further discussions with the ICO.

The email said: “The ICO have confirmed that we’re acting within the law. They acknowledged that we’re not abusing the Data Protection Act.”

The ICO, however, says its position remains unchanged.

A spokesman says: “L&G did not clear this with us in advance. It seriously misrepresents our position and we have asked Legal & General to send out a notice correcting it.”

An L&G spokeswoman says the insurer is having “ongoing conversations” with the ICO.

UnderwriteMe head of sales and marketing Phil Jeynes says: “A lot of insurers trialled subject access requests in an attempt to speed up the underwriting process, but they should be using technology to gather better data on customers instead.”

Protection Review chief executive Kevin Carr says: “Advisers want the process to be as quick and unobtrusive for the client as possible. In those respects subject access requests are preferable to GP reports.

“Particularly for older customers, historic medical records are in the basements and attics of GP surgeries, and getting hold of that information can really slow down the application process.”

Cura Financial Services managing director Alan Knowles says: “If L&G continues to use subject access requests but the BMA has told its members not to comply with them, then that could waste a lot of time.

“Subject access requests are usually quicker and also give peace of mind that the insurer has all the information about the customer.”

Expert view: Industry must find a proper solution

It is no surprise that the medical profession has stood up against insurers’ use of subject access requests as this is not what they were designed for.

Insurers were looking for a way of speeding up the underwriting process, but ultimately we should be looking for ways to do that which do not involve writing to GPs at all.

Insurers should be using smarter technology to gather better data from their customers which takes GPs out of the process as far as possible.

We are a long way away from NHS records being accessible online and realistically that may never happen, so the onus is on insurers to solve the problem.

The issue with GP reports is that unlike subject access requests, which must be responded to within 40 days, there is no maximum time limit.

And so while GP reports generally come back in a week or two, there can be crazy outliers if a doctor is on holiday or the request gets stuck at the bottom of an in tray.

But subject access requests were a fudge rather than a real solution to the problem.